Creating a GitHub PAT

Holden needs a Personal Access Token (PAT) to fetch holden.yml from private GitHub repos and pull private images from GitHub Container Registry (GHCR).

Create the token

1. Go to github.com/settings/tokens/new

2. Fill in:

   • Note: holden (or whatever you’ll remember)
   • Expiration: Pick a duration (90 days is fine, you can always regenerate)

3. Under Select scopes, check:

   • repo (Full control of private repositories)
   • read:packages (Download packages from GitHub Package Registry)

   The repo scope lets Holden clone private repos to read config files. The read:packages scope lets Holden pull private container images from GHCR when deploying your apps.

4. Click Generate token and copy it immediately (you won’t see it again)

Pass it to Holden

Add the token and your GitHub username to your Holden container:

docker-compose.yml

services:
  holden:
    environment:
      - GITHUB_USERNAME=your-username
      - GITHUB_PAT=ghp_xxxxxxxxxxxx

Or via .env file, Docker secrets, etc.—however you manage secrets.

GITHUB_USERNAME is required for pulling private images from GHCR. If you only need private repo access (no private images), GITHUB_PAT alone is sufficient.